WO2014207919A1

WO2014207919A1 - Electronic device

Info

Publication number: WO2014207919A1
Application number: PCT/JP2013/067880
Authority: WO
Inventors: 外山　春彦
Original assignee: 株式会社東芝
Priority date: 2013-06-28
Filing date: 2013-06-28
Publication date: 2014-12-31
Also published as: US20160112449A1; JP5976934B2; US10313374B2; JPWO2014207919A1

Abstract

According to an embodiment, an electronic device is equipped with a generation means, a first storage unit, a setting means, and a transmission processing unit. The generation means generates logs of packets transmitted to a fist communication device and packets transmitted from the fist communication device. The first storage unit stores the logs generated by the generation means. The setting means sets transmission standby times with respect to the logs stored in the storage unit in accordance with the number of the logs stored in the storage unit. The transmission processing unit performs processing for transmitting the respective logs to an analysis device in accordance with the transmission standby times of the respective logs.

Description

Electronics

Embodiments described herein relate generally to an electronic device that transmits a communication log.

The threat of security attacks on control systems is increasing. On the other hand, unlike IT systems, the equipment update period is long, and the risk of system outages due to updates is high. Therefore, techniques for detecting attacks through log monitoring have attracted attention. . A typical log is a communication log.

JP 2008-071085 A JP 2005-250906 A JP 2012-181744 A

A large number of communication logs are sent when a large number of communication packets are generated in a short period of time called multiple state change that occurs in the case of a failure in the control system. For this reason, when a large number of communication logs are generated in a short time, there are cases where the transmission delay of communication packets, regular packets, and communication logs are lost due to an increase in network bandwidth and server load.

An object of the present invention is to provide an electronic device capable of preventing transmission delay of communication packets and loss of regular packets and communication logs when a large number of communication logs are generated in a short time. is there.

According to the embodiment, the electronic device includes a generation unit, a first storage unit, a setting unit, and a transmission processing unit. The generation unit generates a log of packets transmitted to the first communication device and packets transmitted from the first communication device. The first storage unit stores the log generated by the generating unit. The setting means sets a transmission waiting time for the logs stored in the storage unit according to the number of logs stored in the storage unit. The transmission processing means performs processing for transmitting each log to the analysis device according to the transmission standby time of each log.

FIG. 1 is a block diagram illustrating an example of a system configuration. FIG. 2 is a block diagram illustrating an example of a configuration of a control system including the communication log generation device according to the embodiment. FIG. 3 is a block diagram illustrating an example of a configuration of the communication log generation device according to the embodiment. FIG. 4 is a flowchart showing a procedure for setting a standby time in the communication log after the communication log is generated. FIG. 5 is a flowchart showing a procedure for transmitting a communication log. FIG. 6 is a block diagram illustrating an example of the configuration of the security monitoring center. FIG. 7 is a block diagram illustrating an example of the configuration of the communication log generation device according to the embodiment.

Hereinafter, embodiments will be described with reference to the drawings.

FIG. 1 is a diagram illustrating an example of the configuration of a system including a communication log generation device according to the present embodiment.

As shown in FIG. 1, a remote monitoring system 20 and a security monitoring center 30 are connected to a control system 10 to be monitored for security via a network A such as the Internet. The security monitoring center 30 detects and reports an attack on the control system by analyzing and monitoring the communication log transmitted from the control system 10.

The remote monitoring system 20 may not be provided. The network connecting the control system 10 and the remote monitoring system 20 and the network connecting the control system 10 and the security monitoring center 30 may be the same network or different networks.

The control system 10 monitors plants, buildings, and the like. The control system 10 notifies the remote monitoring system 20 of the monitoring result. The remote monitoring system 20 controls the control system 10 based on the monitoring result.

The control system 10 transmits a communication log described later to the security monitoring center 30. The security monitoring center 30 analyzes the communication log. The log analysis unit 204 detects a security attack or an intrusion that is a sign of the security attack by analysis.

FIG. 2 is a block diagram showing an example of the configuration of the control system 10 including the communication log generation device of the present embodiment that transmits a communication log. The control system 10 includes communication

log generation devices

100A and 100B,

controllers

110A and 110B,

sensors

111A and 111B, actuators (ACT) 112A and 112B, a control server 120, a router 130, and the like.

Controllers

110A and 110B are connected to a network B such as a LAN (local area network) via communication

log generation apparatuses

100A and 100B.

Sensors

111A and 111B and

actuators

112A and 112B are connected to the

controllers

110A and 110B. A control server 120 and a router 130 are connected to the network B. There may be a plurality of

sensors

111A and 111B. There may be a plurality of

actuators

112A and 112B.

FIG. 3 is a block diagram illustrating an example of the configuration of the communication log generation device.
The communication log generation device 100 includes a first transmission / reception unit 101, a relay unit 102, a second transmission / reception unit 103, a communication log generation unit 104, a temporary storage unit 105, a transmission delay time setting unit 106, a random number generation unit 107, a communication log A transmission processing unit 108 and a communication log transmission time storage unit 109 are provided.

The first transmission / reception unit 101 receives the packet data transmitted from the controller 110. The first transmission / reception unit 101 transmits the packet data transmitted from the controller 110 to the second transmission / reception unit 103 via the relay unit 102. The second transmission / reception unit 103 transmits the packet data received via the relay unit 102.

The second transmission / reception unit 103 receives packet data addressed to the controller 110. The second transmission / reception unit 103 transmits packet data addressed to the controller 110 to the first transmission / reception unit 101 via the relay unit 102. The first transmission / reception unit 101 transmits packet data received via the relay unit 102 to the controller 110.

The relay unit 102 transmits the received packet data to the communication log generation unit 104. Each time the communication log generation unit 104 receives packet data, the communication log generation unit 104 generates a communication log based on the received packet data. The communication log includes, for example, a destination of a packet transmission source, a destination of a transmission destination, all data of packet data, or data of a predetermined number of bytes. The communication log further includes a time stamp. The communication log generation unit 104 stores the generated communication log in the temporary storage unit 105.

The transmission delay time setting unit 106 sets the transmission standby time of each communication log stored in the temporary storage unit 105 according to the number of communication logs stored in the temporary storage unit 105. When the number of communication logs stored in temporary storage unit 105 is not greater than the set value, transmission delay time setting unit 106 sets the transmission standby time of each communication log stored in temporary storage unit 105 to 0. To do. When the number of communication logs stored in the temporary storage unit 105 is larger than the set value, the transmission delay time setting unit 106 sets the transmission standby time of each communication log stored in the temporary storage unit 105 to a value greater than zero. Set to.

When a communication log is newly stored in the temporary storage unit 105, the transmission delay time setting unit 106 counts the number of communication logs stored in the temporary storage unit 105. When the number of communication logs is not larger than the set number, the transmission delay time setting unit 106 sets the transmission waiting time of the communication log stored in the temporary storage unit 105 to zero. When the number of communication logs is larger than the set number, the transmission delay time setting unit 106 sets the transmission delay time for all communication logs stored in the temporary storage unit 105. The transmission delay time setting unit 106 converts the random number generated by the random number generation unit 107 into a transmission standby time using a predetermined function. For example, a linear function is used as the predetermined function. The transmission delay time setting unit 106 sets the transmission standby time converted into the communication log. Nao, the transmission delay time setting unit 106 may set a predetermined time as the transmission standby time.

The communication log transmission processing unit 108 performs processing for transmitting the communication log to the security monitoring center 30 serving as an analysis device based on the transmission standby time set in each communication log in the temporary storage unit 105. When the communication log is transmitted, the communication log transmission processing unit 108 records transmission time information indicating the transmission time in the communication log transmission time storage unit 109.

FIG. 4 is a flowchart showing a procedure for setting a waiting time in the communication log after the communication log is generated. With reference to the flowchart of FIG. 4, a procedure for setting a waiting time in the communication log after the communication log is generated will be described.

When the packet data addressed to the controller 110 or the packet data transmitted from the controller 110 is received, the communication log generation unit 104 generates a communication log based on the received packet data (step B11). The communication log generation unit 104 stores the generated packet data in the temporary storage unit 105 (step B12).

When a communication log is newly stored in the temporary storage unit 105, the transmission delay time setting unit 106 counts the number of communication logs stored in the temporary storage unit 105 (step B13). The transmission delay time setting unit 106 determines whether the counted number of communication logs is larger than the number of communication logs (step B14). When the number of communication logs stored in the temporary storage unit 105 is larger than the set number (Yes in step B14), the transmission delay time setting unit 106 temporarily stores the communication logs stored in the temporary storage unit 105. It is determined whether a transmission delay time is set in the oldest communication log in the storage unit 105 (step B15). When it is determined that the transmission delay time is set (Yes in step B15), the transmission delay time setting unit 106 sets the transmission delay time for the communication log stored last in the temporary storage unit 105 ( Step B16). When it is determined that the transmission delay time is not set (No in Step B15), the transmission delay time setting unit 106 sets the transmission delay time for all communication logs in the temporary storage unit 105 (Step B17). .

When the number of communication logs stored in the temporary storage unit 105 in step B14 is not larger than the set number (No in step B14), the transmission delay time setting unit 106 stores all of the communication logs stored in the temporary storage unit 105. Is set to 0 (step B18).

FIG. 5 is a flowchart showing a procedure for transmitting a communication log. A procedure for transmitting a communication log will be described with reference to the flowchart of FIG.
The communication log transmission processing unit 108 acquires the transmission delay time set in the oldest communication log in the temporary storage unit 105 (step B21). The communication log transmission processing unit 108 acquires transmission time information indicating the transmission time of the communication log last transmitted from the communication log transmission time storage unit 109 (step B22). The communication log transmission processing unit 108 determines whether the scheduled transmission time, which is the time obtained by adding the transmission standby time to the transmission time of the communication log transmitted last, is over (step B23). When it is determined that the current time has not passed the scheduled transmission time (No in Step B23), the transmission delay time setting unit 106 executes Step B23 again after a predetermined time. The predetermined time is, for example, a time obtained by subtracting the current time from the scheduled transmission time.

When it is determined that the current time has passed the scheduled transmission time (Yes in step B23), the communication log transmission processing unit 108 uses the second transmission / reception unit 103 to store the oldest communication log in the temporary storage unit 105. Is transmitted to the security monitoring center 30 (step B24). The communication log transmission processing unit 108 records the transmission time in the communication log transmission time storage unit 109 (step B25). The communication log transmission processing unit 108 deletes the oldest communication log in the temporary storage unit 105 (step B26).

When the number of communication logs stored in the temporary storage unit 105 is larger than the set number, the communication log is not transmitted immediately, but is transmitted by delaying the communication log. Even when such a large number of status change events are generated, the communication log can be communicated without the communication line becoming tight with the communication log.

(Time correction)
Delaying the transmission of the communication log causes a difference between the reception time at the security monitoring center 30 and the event occurrence time. Although this problem can be avoided by putting a time stamp in the communication log, the time synchronization of each device needs to be accurate. Therefore, when a delay is added, it is possible to add a delay time information based on the delay time to the communication log so that the security monitoring center can correct the time. The delay time information is a time indicating a difference between the scheduled transmission time and the communication log generation time.

FIG. 6 is a block diagram illustrating an example of the configuration of the security monitoring center 30.
The security monitoring center 30 includes a log receiving unit 201, a log recording unit 202, a time correction unit 203, a log analysis unit 204, a result presentation unit 205, and the like.

The log receiving unit 201 receives a communication log via the network A. The received communication log is stored in the log recording unit 202. The received communication log is notified to the time correction unit 203. The time correction unit 203 corrects the transmission time (or reception time) of the communication log based on the delay time information in the communication log. The log analysis unit 204 analyzes the communication log using the corrected time. The log analysis unit 204 detects a security attack or an intrusion that is a sign of the security attack by analysis. Specifically, there is an analysis called anomaly analysis. For example, there is a method of determining an attack by finding a communication pattern different from a normal communication pattern by correlation analysis or the like. As a result, for example, in a port scan for finding an attack target that is normally performed prior to an attack, it is possible to discover a large number of accesses to ports that are not normally used. When a security attack or an intrusion that is a sign of the security attack is detected, the result presentation unit 205 performs a process of presenting the fact.

(Modification)
As shown in FIG. 7, a log transmission unit 301 for transmitting a communication log is provided, and the communication log transmission processing unit 108 performs processing for transmitting a communication log to the security monitoring center 30 using the log transmission unit 301. You can go.

In the above embodiment, the scheduled transmission time, which is the time when the transmission waiting time is added to the transmission time of the communication log transmitted last, is the time when the transmission waiting time is added to the time when the communication log is generated. May be the scheduled transmission time. In this case, the delay time information is a time indicating a difference between the scheduled transmission time and the communication log generation time.

According to the present embodiment, when the number of communication logs stored in the temporary storage unit 105 is larger than the set number, the communication log is not transmitted immediately, but is transmitted with a delay, Even when a large number of status change events such as multiple status changes in the control system are generated, the communication line is not constrained by the communication log, preventing transmission packet transmission delays and loss of regular packets and communication logs. It becomes possible.

Note that all procedures performed by the communication log generation unit 104, the transmission delay time setting unit 106, the random number generation unit 107, and the communication log transmission processing unit 108 of the present embodiment can be executed by software. For this reason, it is possible to easily realize the same effect as that of the present embodiment simply by installing and executing this program on a normal computer through a computer-readable storage medium storing a program for executing the control processing procedure. it can.

Although several embodiments of the present invention have been described, these embodiments are presented as examples and are not intended to limit the scope of the invention. These novel embodiments can be implemented in various other forms, and various omissions, replacements, and changes can be made without departing from the scope of the invention. These embodiments and modifications thereof are included in the scope and gist of the invention, and are included in the invention described in the claims and the equivalents thereof.

Claims

Generating means for generating a log of a packet transmitted to the first communication device and a packet transmitted from the first communication device;
A first storage unit for storing a log generated by the generating unit;
Setting means for setting a transmission standby time for each log stored in the first storage unit according to the number of logs stored in the storage unit;
According to the transmission waiting time of each log, transmission processing means for performing processing for transmitting each log to the analyzer,
An electronic device comprising:
A random number generator for generating random numbers;
The electronic device according to claim 1, wherein the setting unit sets a transmission standby time based on a random number generated by the random number generation unit.
A second storage unit that stores transmission time information indicating the transmission time of the last transmitted log;
The transmission processing means performs processing for transmitting the first log to the analyzer based on a transmission time indicated by the transmission time information and a transmission standby time set in the first log. 1. The electronic device according to 1.
The electronic device according to claim 1, wherein the log includes standby time information based on a transmission standby time.
Generating a log of packets transmitted to the first communication device and packets transmitted from the first communication device;
Storing the log in a storage unit;
According to the number of logs stored in the storage unit, set a transmission waiting time for the log stored in the storage unit,
A log transmission method for performing processing for transmitting each log to the analyzer according to the transmission waiting time of each log.
Generating a log of packets transmitted to the first communication device and packets transmitted from the first communication device;
A procedure for storing the log in a storage unit;
According to the number of logs stored in the storage unit, a procedure for setting a transmission waiting time for the log stored in the storage unit,
A program for causing a computer to execute processing for transmitting each log to the analyzer according to the transmission waiting time of each log.